Perfectly Secure and Efficient Two-Party Electronic-Health-Record Linkage

Privacy-preserving federated genome-wide association studies via dynamic sampling

MOTIVATION

Genome-wide association studies (GWAS) benefit from the increasing availability of genomic data and cross-institution collaborations. However, sharing data across institutional boundaries jeopardizes medical data confidentiality and patient privacy. While modern cryptographic techniques provide formal secure guarantees, the substantial communication and computational overheads hinder the practical application of large-scale collaborative GWAS.

RESULTS

This work introduces an efficient framework for conducting collaborative GWAS on distributed datasets, maintaining data privacy without compromising the accuracy of the results. We propose a novel two-step strategy aimed at reducing communication and computational overheads, and we employ iterative and sampling techniques to ensure accurate results. We instantiate our approach using logistic regression, a commonly used statistical method for identifying associations between genetic markers and the phenotype of interest. We evaluate our proposed methods using two real genomic datasets and demonstrate their robustness in the presence of between-study heterogeneity and skewed phenotype distributions using a variety of experimental settings. The empirical results show the efficiency and applicability of the proposed method and the promise for its application for large-scale collaborative GWAS.

AVAILABILITY AND IMPLEMENTATION

The source code and data are available at https://github.com/amioamo/TDS.

Implementing an electronic public health record for policy planning in the UK military sector: Validation of a secure hashing algorithm

The digitalisation of healthcare services is a major resource to inform policy-makers. However, the availability of data and the establishment of a data flow present new issues to address, such as data anonymisation, records' reliability, and data linkage. The veterans' population in the UK presents complex needs and many organisations provide social and healthcare support, but their databases are not linked or aggregated to provide a comprehensive overview of service planning. This study aims to test the sensitivity and specificity of a Secure Hashing Algorithm to generate a unique anonymous identifier for data linkage across different organisations in the veterans' population. A Secure Hashing Algorithm was performed by considering two input variables from two different datasets. The uniqueness of the identifier was compared against the single personal key adopted as a current standard identifier. Chi-square, sensitivity, and specificity were calculated. The results demonstrated that the unique identifier generated by the Secure Hashing Algorithm detected more unique records when compared to the current gold standard. The identifier demonstrated optimal sensitivity and specificity and it allowed an enhanced data linkage between different datasets. The adoption of a Secure Hashing Algorithm improved the uniqueness of records. Moreover, it ensured data anonymity by transforming personal information into an encrypted identifier. This approach is beneficial for big data management and for creating an aggregated system for linking different organisations and, in this way, for providing a more comprehensive overview of healthcare provision and the foundation for precision public health strategies.

EasySMPC: a simple but powerful no-code tool for practical secure multiparty computation

BACKGROUND

Modern biomedical research is data-driven and relies heavily on the re-use and sharing of data. Biomedical data, however, is subject to strict data protection requirements. Due to the complexity of the data required and the scale of data use, obtaining informed consent is often infeasible. Other methods, such as anonymization or federation, in turn have their own limitations. Secure multi-party computation (SMPC) is a cryptographic technology for distributed calculations, which brings formally provable security and privacy guarantees and can be used to implement a wide-range of analytical approaches. As a relatively new technology, SMPC is still rarely used in real-world biomedical data sharing activities due to several barriers, including its technical complexity and lack of usability.

RESULTS

To overcome these barriers, we have developed the tool EasySMPC, which is implemented in Java as a cross-platform, stand-alone desktop application provided as open-source software. The tool makes use of the SMPC method Arithmetic Secret Sharing, which allows to securely sum up pre-defined sets of variables among different parties in two rounds of communication (input sharing and output reconstruction) and integrates this method into a graphical user interface. No additional software services need to be set up or configured, as EasySMPC uses the most widespread digital communication channel available: e-mails. No cryptographic keys need to be exchanged between the parties and e-mails are exchanged automatically by the software. To demonstrate the practicability of our solution, we evaluated its performance in a wide range of data sharing scenarios. The results of our evaluation show that our approach is scalable (summing up 10,000 variables between 20 parties takes less than 300 s) and that the number of participants is the essential factor.

CONCLUSIONS

We have developed an easy-to-use "no-code solution" for performing secure joint calculations on biomedical data using SMPC protocols, which is suitable for use by scientists without IT expertise and which has no special infrastructure requirements. We believe that innovative approaches to data sharing with SMPC are needed to foster the translation of complex protocols into practice.

A data flow process for confidential data and its application in a health research project

BACKGROUND

The use of linked healthcare data in research has the potential to make major contributions to knowledge generation and service improvement. However, using healthcare data for secondary purposes raises legal and ethical concerns relating to confidentiality, privacy and data protection rights. Using a linkage and anonymisation approach that processes data lawfully and in line with ethical best practice to create an anonymous (non-personal) dataset can address these concerns, yet there is no set approach for defining all of the steps involved in such data flow end-to-end. We aimed to define such an approach with clear steps for dataset creation, and to describe its utilisation in a case study linking healthcare data.

METHODS

We developed a data flow protocol that generates pseudonymous datasets that can be reversibly linked, or irreversibly linked to form an anonymous research dataset. It was designed and implemented by the Comprehensive Patient Records (CPR) study in Leeds, UK.

RESULTS

We defined a clear approach that received ethico-legal approval for use in creating an anonymous research dataset. Our approach used individual-level linkage through a mechanism that is not computer-intensive and was rendered irreversible to both data providers and processors. We successfully applied it in the CPR study to hospital and general practice and community electronic health record data from two providers, along with patient reported outcomes, for 365,193 patients. The resultant anonymous research dataset is available via DATA-CAN, the Health Data Research Hub for Cancer in the UK.

CONCLUSIONS

Through ethical, legal and academic review, we believe that we contribute a defined approach that represents a framework that exceeds current minimum standards for effective pseudonymisation and anonymisation. This paper describes our methods and provides supporting information to facilitate the use of this approach in research.

Developing High Performance Secure Multi-Party Computation Protocols in Healthcare: A Case Study of Patient Risk Stratification

We demonstrate that secure multi-party computation (MPC) using garbled circuits is viable technology for solving clinical use cases that require cross-institution data exchange and collaboration. We describe two MPC protocols, based on Yao's garbled circuits and tested using large and realistically synthesized datasets. Linking records using private set intersection (PSI), we compute two metrics often used in patient risk stratification: high utilizer identification (PSI-HU) and comorbidity index calculation (PSI-CI). Cuckoo hashing enables our protocols to achieve extremely fast run times, with answers to clinically meaningful questions produced in minutes instead of hours. Also, our protocols are provably secure against any computationally bounded adversary in a semi-honest setting, the de-facto mode for cross-institution data analytics. Finally, these protocols eliminate the need for an implicitly trusted third-party "honest broker" to mediate the information linkage and exchange.

Efficient determination of equivalence for encrypted data

Secure computation of equivalence has fundamental application in many different areas, including health-care. We study this problem in the context of matching an individual's identity to link medical records across systems under the socialist millionaires' problem: Two millionaires wish to determine if their fortunes are equal without disclosing their net worth (Boudot, et al. 2001). In Theorem 2, we show that when a "greater than" algorithm is carried out on a totally ordered set it is easy to achieve secure matching without additional rounds of communication. We present this efficient solution to assess equivalence using a set intersection algorithm designed for "greater than" computation and demonstrate its effectiveness on equivalence of arbitrary data values, as well as demonstrate how it meets regulatory criteria for risk of disclosure.

Review of Clinical Research Informatics

OBJECTIVES

Clinical Research Informatics (CRI) declares its scope in its name, but its content, both in terms of the clinical research it supports-and sometimes initiates-and the methods it has developed over time, reach much further than the name suggests. The goal of this review is to celebrate the extraordinary diversity of activity and of results, not as a prize-giving pageant, but in recognition of the field, the community that both serves and is sustained by it, and of its interdisciplinarity and its international dimension.

METHODS

Beyond personal awareness of a range of work commensurate with the author's own research, it is clear that, even with a thorough literature search, a comprehensive review is impossible. Moreover, the field has grown and subdivided to an extent that makes it very hard for one individual to be familiar with every branch or with more than a few branches in any depth. A literature survey was conducted that focused on informatics-related terms in the general biomedical and healthcare literature, and specific concerns ("artificial intelligence", "data models", "analytics", etc.) in the biomedical informatics (BMI) literature. In addition to a selection from the results from these searches, suggestive references within them were also considered.

RESULTS

The substantive sections of the paper-Artificial Intelligence, Machine Learning, and "Big Data" Analytics; Common Data Models, Data Quality, and Standards; Phenotyping and Cohort Discovery; Privacy: Deidentification, Distributed Computation, Blockchain; Causal Inference and Real-World Evidence-provide broad coverage of these active research areas, with, no doubt, a bias towards this reviewer's interests and preferences, landing on a number of papers that stood out in one way or another, or, alternatively, exemplified a particular line of work.

CONCLUSIONS

CRI is thriving, not only in the familiar major centers of research, but more widely, throughout the world. This is not to pretend that the distribution is uniform, but to highlight the potential for this domain to play a prominent role in supporting progress in medicine, healthcare, and wellbeing everywhere. We conclude with the observation that CRI and its practitioners would make apt stewards of the new medical knowledge that their methods will bring forward.

Enabling Privacy Preserving Record Linkage Systems Using Asymmetric Key Cryptography

We present a systemic approach to devise and deploy Privacy Preserving Record Linkage (PPRL) systems using asymmetric key cryptography and illustrate the strengths of such an approach. With our approach, the security implications of sharing a common secret salt across the network may be avoided, allowing the local participating sites to use private keys along with the current cryptographic hashes to maximally secure their own data. In addition, the final cyphertext tokens are compatible with those used by existing record linkage modules, allowing seamless integration with the existing PPRL infrastructures for downstream analysis. Finally, study-specific hash production requires action only by the central party. The main intuition for this work is derived from how asymmetric key approaches have enabled internet-scale applications. We demonstrate that such a design, where the local sites no longer need special-purpose software, affords greater flexibility and scalability for large scale multi-site linkage studies.

Enhancing diversity to reduce health information disparities and build an evidence base for genomic medicine

Advances in genomic medicine are arising from efforts to build a national learning healthcare system (LHS) and large-scale precision medicine studies. However, the underlying evidence base lacks sufficient data from populations historically underrepresented in biomedical research. Although the literature on health and healthcare disparities is extensive, disparities in the availability and quality of health information about diverse and underrepresented populations are less well characterized. This Perspective describes scientific and ethical benefits to incorporating health information from diverse and underrepresented populations in the LHS, resulting in a more robust and generalizable LHS. Near-term recommendations for incorporating diversity into the evidence base for genomic medicine are proposed, even as the groundwork for national and international efforts is underway.